Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Split Tunnel SMTP Exploit Bypasses Email Security Gateways
Newest First  |  Oldest First  |  Threaded View
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:51:55 PM
Re: Pending Review
"This is akin to saying driving a car is bad because a person doesn't use the seat belts."

I agree, at the end of the day we come back to human being the weakest link.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:49:27 PM
Re: Pending Review
"The fact that someone architects a system and does not send the email through the SEG is simply poor design"

Agreed and good points. Most SMEs would not have that one, they hardly have physical firewall I would say.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:47:25 PM
Re: Why you need multiple layers of security
"having multiple layers of security."

Agree. Layered security most likely detect this types of threats. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:45:44 PM
Re: Thanks for sharing
"What a simple security hole"

Agree. As one could guess, sometimes simple things impact the environment most.

 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:44:28 PM
TCP dedicated ports
Best approach to avoid TCP dedicated ports it seems to avoid this threat.
TomF593
0%
100%
TomF593,
User Rank: Apprentice
5/27/2017 | 8:18:47 AM
Re: Pending Review
I'm not sure I would classify this as an exploit in the terms you have laid out the scenario. This does show very poor email security architecture design but modern SEG (Secure Email Gateways) contains A/V and Anti-Malware engines to detect the presence of malware in email. The fact that someone architects a system and does not send the email through the SEG is simply poor design.

This is akin to saying driving a car is bad because a person doesn't use the seat belts. Yes it is dangerous, yes it is bad, however you can't blame the car saying it is unsafe. The operator is unsafe, they chose not to put on the seat belts and benefit from the protect afforded.

"In some configurations, the email encryption appliance is deployed in front of the security gateway to decrypt encrypted mail, and to forward it to the security gateway, which then inspects the decrypted email for malware before sending it to the email server.

Even in such situations, an attacker who is able to connect directly to the encryption appliance can inject a rogue message into it. When the security gateway receives the message and inspects it for malware, it will typically do so using the encryption device's IP address and not the original sender's IP address, Singla says. This gives an opening for an attacker to get messages containing malicious payloads and links past the email security gateway." 

Again poor design architecture/implementation a properly configured SEG would look back in headers and discover the true sending MTA IP address not take the encryption device as the source.

"The Split Tunnel SMPT attack does not work if port 25 is closed. "The two attacks we show require port 25 to be open on the target's [Mail Transfer Appliance]," says Singla."

If you can't reach port 25 no mail would flow. This statement is not even needed. Again like saying if I don't answer the phone you can't talk to me.
DougMorganBreakpoint
50%
50%
DougMorganBreakpoint,
User Rank: Apprentice
5/25/2017 | 3:33:22 PM
Why you need multiple layers of security
Creative attack, and a great argument for having multiple layers of security.  Clearly this can bypass email security.  Hopefully the the organization has web filtering or other policies in place to block access to command and control sites to limit the damage if a user does fall for the delivered phiishing email.
realuser
100%
0%
realuser,
User Rank: Apprentice
5/25/2017 | 3:06:16 PM
Thanks for sharing
What a simple security hole... Latest methods to deliver malware became really interesting. Nice work!


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-42258
PUBLISHED: 2021-10-22
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include ...
CVE-2020-28968
PUBLISHED: 2021-10-22
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.
CVE-2020-28969
PUBLISHED: 2021-10-22
Aplioxio PDF ShapingUp 5.0.0.139 contains a buffer overflow which allows attackers to cause a denial of service (DoS) via a crafted PDF file.
CVE-2020-36485
PUBLISHED: 2021-10-22
Portable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in the filename parameter of the upload module. This vulnerability allows attackers to execute arbitrary code via a crafted JPEG file.
CVE-2020-36486
PUBLISHED: 2021-10-22
Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the 'path' parameter of the 'list' and 'download' exception-handling.